Log in or register
Share on LinkedInShare on LinkedIn

ARTICLE · 20 OCTOBER 2026

Cross-Border Data Incident Response: What We Learned So You Don't Have To

Mishcon de Reya LLP
Mishcon de Reya LLP
Contributor
Mishcon de Reya LLP

Mishcon de Reya LLP

Founded by Lord Mishcon in 1937, in a one-room office in Brixton, Mishcon de Reya now employs over...

View firm profile
Explore more from Mishcon de Reya LLP

Mishcon de Reya's Data team explores the critical challenges of managing personal data breaches across multiple jurisdictions, examining how notification obligations, regulatory expectations, and personal liability for directors vary significantly between markets. Drawing from a hypothetical cross-border incident scenario, the firm's experts reveal why preparation, local counsel networks, and understanding jurisdictional differences are essential before a breach occurs.

United KingdomPrivacy
Aselle Ibraimova
Aselle Ibraimova
Paolo Sbuttoni
Paolo Sbuttoni

On 16 September 2026, the Data team hosted a breakfast briefing on cross-border personal data breach response, bringing together our experts to share practical lessons from live, multi-jurisdictional incidents.

session was chaired by Aselle Ibraimova, with a panel comprising Jon Baines, Louise Schofield, and Paolo Sbuttoni. The panel worked through a hypothetical scenario: a personal data breach affecting individuals across multiple jurisdictions (including APAC countries), involving a security incident, a threat actor, third-party service providers, and information about the breach already circulating publicly. This allowed attendees to test how response strategy, notification obligations and personal liability play out in practice when a breach crosses borders and the clock is already running.

We operate a free-to-view policy, asking only that you register in order to read all of our content. Please login or register to view the rest of this article.

Register for freeORLog in

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

View source

Related Articles

Legal Intelligence Newsletters: sign up for the latest legal and regulatory news on your chosen topics

Read more about

Related Comparative Guides

See more popular content from

Article

Ten AI Giants, One Regulator And A Lesson For Everyone Else: What The ICO’s Foundation Model Report Really Tells Us

The UK's Information Commissioner's Office has completed its supervision of major AI foundation model developers, revealing significant gaps in data protection practices and setting new expectations for legitimate interests assessments, transparency, and special category data handling. The regulator has now turned its attention to agentic AI systems, warning that autonomy is not an excuse for poor compliance and launching a call for evidence that will shape future regulatory guidance.
United KingdomPrivacy
Burges Salmon LLP
Burges Salmon LLP
Article

ICO Cookie Crackdown 2.0: The ICO’s New Storage And Access Technologies Guidance

The UK Information Commissioner's Office has finalized its guidance on storage and access technologies, expanding compliance requirements beyond traditional cookies to include tracking pixels, device fingerprinting, and web storage. Organizations must now navigate stricter consent standards and three new narrow exceptions introduced by the Data (Use and Access) Act 2025, while facing significantly increased enforcement penalties of up to £17.5 million or 4% of annual worldwide turnover.
United KingdomPrivacy
ZwillGen
ZwillGen
Article

European Commission Press Release: EU AI Act Transparency Enforcement Starts This Sunday! Do You Know Who Your Chatbots Are? We Break Down The Commission’s Guidelines On Transparency Below

The European Commission has announced that EU AI Act transparency rules take effect August 2, 2026, requiring chatbots to identify themselves, deepfakes to be labeled, and AI-generated content to be marked. Organizations must assess whether their AI systems trigger disclosure, labeling, or content-marking requirements, with limited exceptions and penalties reaching €15 million or 3% of global turnover for noncompliance.
GlobalPrivacy
Seyfarth Shaw LLP
Seyfarth Shaw LLP
Article

ICO Launches Consultation On Draft Guidance Regarding Anonymisation And Pseudonymisation For Research Purposes

The UK's Information Commissioner's Office has opened a public consultation on draft guidance addressing anonymisation and pseudonymisation techniques for processing personal data in research, archiving, and statistical contexts. The guidance explores critical distinctions between anonymous and pseudonymous data, outlines required safeguards under UK GDPR, and examines emerging technologies including synthetic data and privacy-enhancing tools.
United KingdomPrivacy
A&O Shearman
A&O Shearman
Article

UK Right To Work Checks: What Changes On 1 October 2026

The UK's right-to-work regime is undergoing a fundamental transformation that will extend compliance obligations far beyond traditional employment relationships. From 1 October 2026, businesses engaging contractors, agency workers, platform-based workers, and complex supply chains will face new liability risks that travel up entire contracting chains. Understanding these changes and implementing the required contractual terms, substitution controls, and identity verification systems is now critical for orga
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Manchester City: Independent Commission Publishes Decision On Premier League Charges

An independent Premier League Commission has found Manchester City in breach of financial rules spanning nine seasons, with findings that the club artificially inflated revenues and reduced costs by over £900 million. The decision marks what the Premier League describes as the most significant case in its history, though Manchester City strongly disputes the findings and intends to appeal, setting the stage for further proceedings that could reshape English football's regulatory landscape.
United KingdomCorporate/Commercial Law
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Meta's $18 Billion Settlement: Reckoning Or Managed Exit?

Meta has agreed to pay up to $18 billion over 10 years to settle claims by 52 US state and territory attorneys general in the largest state consumer-protection settlement in American history outside tobacco. The settlement imposes binding child-safety obligations including time limits and age assurance, but leaves the core algorithmic feed unchanged and raises questions about whether this represents genuine accountability or a commercially managed outcome.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

The New Trade Union Right Of Access: What Employers Need To Do Now

From 30 October 2026, independent trade unions will gain statutory rights to access workplaces - both physically and digitally - regardless of existing union membership or recognition. With tight statutory deadlines for responding to access requests and penalties reaching £500,000 for repeated breaches, employers face a significant shift in how unions can establish themselves in previously non-unionised workplaces.
United KingdomEmployment and HR
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Samsung Ordered To Pay The Swatch Group US$11.6 Million In Damages For Trade Mark Infringement

The High Court has awarded the Swatch Group US$11.6 million in negotiation damages against Samsung for trade mark infringements involving watch face apps on the Galaxy App store. Rejecting both parties' extreme valuations of US$170 million and US$301, the court established important principles for assessing damages when brand owners don't license their marks and no comparable market royalties exist.
United KingdomIntellectual Property
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Can Insurers Avoid Covering Defence Costs Under A D&O Policy Before Fraud Is Proved?

In a landmark ruling, the English Commercial Court has determined that insurers must continue advancing defence costs under D&O policies even when fraud allegations are pending, provided a non-avoidance clause is present. The decision addresses whether such clauses violate public policy and establishes that insurers cannot withhold coverage until fraud is either admitted or proven by final court decision.
United KingdomInsurance
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

R (University Of Sussex) v Office For Students: Reshaping The OfS's Guidance On Freedom Of Speech And Academic Freedom

The High Court's landmark ruling in R (University of Sussex) v Office for Students has fundamentally reshaped how the OfS regulates freedom of speech in higher education, leading to revised guidance that requires holistic policy assessment and proper consideration of remedial actions. With the new free-speech complaints scheme now operational, institutions face heightened scrutiny of their policies and must ensure their frameworks protect lawful speech while meeting equality obligations.
United KingdomConsumer Protection
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: How To Prepare, Monitor And Respond

AI has fundamentally altered how reputation is shaped, with AI-powered search engines now delivering authoritative-seeming summaries rather than traditional search results. From deepfakes and voice cloning to coordinated review bombing and bot-driven harassment campaigns, the threats are evolving rapidly—but so are the defensive tools available to those who understand how to deploy them strategically.
United KingdomMedia, Telecoms, IT, Entertainment
Mishcon de Reya LLP
Mishcon de Reya LLP
Article

Protecting Reputation In The AI Era: Legal Levers For AI-driven Reputational Harm

AI-generated content poses unprecedented reputational threats, from deepfakes to coordinated bot campaigns. While English law lacks AI-specific remedies, existing legal frameworks—including harassment protections, defamation claims, and the Online Safety Act 2023—offer powerful tools for those who act decisively. The emerging question of AI liability itself remains untested, focusing attention on the human decisions behind AI deployment.
United KingdomLitigation, Mediation & Arbitration
Mishcon de Reya LLP
Mishcon de Reya LLP